Cheat Engine

[tbonge]

The game I am working on has energy weapons that each have a max charge constant. I found the code that recharges the weapon. I want to change the max charge constant but can't find the address it loads it from.

I can change the current charge to be higher than the max charge but then the weapon shows 100 shots left out of 50 total. While it works I would prefer the max level not to be less than the current level.

Here is the code that recharges the weapon.

[ParkourPenguin]

edx is probably a parameter. Look at the call(s) to that subroutine and see where the argument is coming from.

[tbonge]

Thank you. I just started using CE 2 days ago, how do I go about finding what calls this subroutine?

Do I use what access this address on 7FF7B149AD88 - mov ebp,edx?

Is there a way to see the value of edx in the trace or would it just be the same as rdx?

Thanks, I appreciate it.

[ParkourPenguin]

Set the break and trace on the write ("add [rbx+00000620],ebp"), check "step over instead of single step," and set the trace count appropriately (between a few hundred and 1000 is usually adequate). The next time the game executes that instruction, the treeview in the trace window should get populated.

Right click on the treeview and select "Expand All". The first instruction you see should be the write (you might need to scroll a bit), and further down there should eventually be a ret instruction. The ret instruction is at the end of a treeview node, and the next instruction in the parent treeview node should be the instruction after the call to the subroutine the write was a part of. If you double click on that instruction, it will go to that address in the disassembler. Scroll up and you should see the instruction that called the subroutine to run. Above that should be whatever instruction stored a value into edx.

This topic has a little more information on backtracing.

[tbonge]

Excellent, thanks so much! I will try this when I get home tonight.